VDB
CVE-2021-32052
CVE-2021-32052
PUBLISHED
CVSS 6.099999904632568 MEDIUM
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
EPSS 3.17% · 87.6th percentile
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
3.17%
87.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | django | 2.2.0, 3.1.0, 3.2.0 |
| Bitnami | django | 3.1.0, 3.2.0, 2.2.0 |
Timeline
- May 6, 2021 CVE Published
- May 7, 2021 EPSS Score
- Jul 10, 2021 EPSS Score
- Nov 12, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 16, 2022 EPSS Score
- May 17, 2022 EPSS Score
- Jul 19, 2022 EPSS Score
- Nov 21, 2022 EPSS Score
- Jan 22, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
References
- https://docs.djangoproject.com/en/3.2/releases/security/ url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/ url
- http://www.openwall.com/lists/oss-security/2021/05/06/1 url
- https://www.djangoproject.com/weblog/2021/may/06/security-releases/ url
- https://nvd.nist.gov/vuln/detail/CVE-2021-32052 url
- https://groups.google.com/forum/#%21forum/django-announce url
- https://security.netapp.com/advisory/ntap-20210611-0002/ url